CVE-2023-20866 json
Spring Session session ID can be logged to the standard output stream
published 2023-04-13 3 y ago modified 2026-06-17 4 mo ago also GHSA-r7qr-f43m-pxfr , EUVD-2023-1390
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Patch / fix
- maven org.springframework.session:spring-session-core 3.0.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-20866 updated cvss 6.5
spring-session: Improper log of session id in standard output stream
-
Red Hat Data Grid 8 spring-session spring-session Red Hat JBoss Data Grid 7 spring-session spring-session Red Hat JBoss Enterprise Application Platform 7 spring-session spring-session Red Hat JBoss Enterprise Application Platform Expansion Pack spring-session spring-session Red Hat OpenShift Dev Spaces devspaces-pluginregistry-rhel8-container=newnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.springframework.session:spring-session-core | >=3.0.0, <3.0.1 |
3.0.1 |
Affected products
- n/a Spring Session
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/spring-projects/spring-session/commit/c98a7be0e2ced7f795018f05397dca4bd5ca8212
web
-
spring.io
/security/cve-2023-20866
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-20866
advisory
-
github.com
/spring-projects/spring-session/issues/2215
web
-
github.com
/spring-projects/spring-session
package
Sources
- CVE List CVE-2023-20866
- GitHub Advisory GHSA-r7qr-f43m-pxfr
- NVD CVE-2023-20866
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.